ActionProof

Verifiable robot experience data.

Register, inspect, license, and independently verify robot-learning episodes.

Live private POC · Manifest schema · Registry contract

ActionProof is a provenance and licensing layer for physical-AI and robotics data. It turns a robot episode into an inspectable passport that binds technical metadata, quality evidence, usage rights, and payment to the exact registered bytes.

The POC focuses on the buyer's real decision—not marketplace theater:

Are these the registered bytes? Can my robot use them? What evidence supports the outcome? What am I legally allowed to do after payment?

1. Discover task-specific episodes using structured search and compatibility filters.
2. Inspect robot embodiment, action space, sensors, timing, outcome evidence, and quality checks.
3. Register a JSON, MCAP, ZIP, or LeRobot-compatible episode.
4. Commit its SHA-256 digest to Base Sepolia while the raw bytes remain off-chain.
5. License it with test USDC and receive a terms-bound receipt.
6. Verify a downloaded file locally; one changed byte produces an explicit mismatch.

ActionProof does not claim that a blockchain hash proves a robot was honest. A commitment proves who registered specific bytes and claims at a point in time.

The UI therefore separates:

• Integrity: do the bytes and manifest match the registered commitments?
• Technical readiness: are schema, timing, calibration, and numeric checks valid?
• Outcome evidence: is success publisher-declared, replay-confirmed, or independently attested?
• Compatibility: does the embodiment and action interface match the buyer's target?
• Rights: which immutable license version did the buyer accept?

Authenticity becomes stronger through signed capture, verified organizations, deterministic replay, and independent attestations—not through a single green badge.

Browser
  ├─ local SHA-256 + metadata extraction
  ├─ independent tamper verifier
  └─ EVM wallet / Base Sepolia
          │
          ▼
Vinext application on Cloudflare Workers
  ├─ API rehashes finalized upload
  ├─ D1: manifests + license receipts
  └─ R2: private episode bytes
          │
          ▼
Base Sepolia
  ├─ episode digest commitment
  └─ test-USDC payment transaction

Raw robot data never goes on-chain. The public projection contains only sanitized metadata, hashes, quality evidence, license terms, and chain references.

Requirements: Node.js 22.13 or newer.

npm install
npm run dev

Open the printed local URL. To test tamper detection, download the sample from the Register screen, verify it, change one byte, and verify it again.

Useful commands:

npm run lint
npm run build
npm run db:generate

app/                         Product UI and API routes
contracts/ActionProofRegistry.sol
                             Terms-bound registry contract for the next phase
db/                          D1 schema and bindings
docs/episode-manifest.schema.json
                             Versioned manifest contract
drizzle/                     Generated database migration
public/sample-episode.json   Deterministic pick-and-place fixture

This is a proof of concept, not an audited production protocol.

• The live flow anchors the content digest in transaction calldata and stores its terms-bound payment receipt in D1.
• Deploying ActionProofRegistry.sol will bind episode, terms, payment, and a non-transferable receipt in one contract event.
• The POC uses a constrained sample parser; full LeRobot v3 and MCAP parsing is next.
• Organization identity, hardware-backed robot signing, encrypted key release, and disputes require production services.
• Testnet tokens have no monetary value.

• RFC 8785 canonical JSON and RFC 6962 Merkle test vectors.
• LeRobot v3 and MCAP adapters with synchronized episode previews.
• Organization and device-key verification with revocation.
• Contract unit, fuzz, invariant, and third-party audit work.
• Encrypted delivery, buyer-specific access grants, and provenance-preserving derivations.
• Third-party quality attestations and target-policy compatibility benchmarks.

Read CONTRIBUTING.md before opening a pull request. Please report vulnerabilities privately using the process in SECURITY.md; do not disclose them in a public issue.

Licensed under the Apache License 2.0. The sample robot episode is synthetic and included for demonstration.